Subject: RE: [Isis-wg] When the next Seq. Number Exceeds Max. Sequence Num ber!

From: Radia Perlman - Boston Center for Networking <[email-masked]>
Date: Fri, 18 Jan 2002 16:02:03 -0500 (EST)

From: Jeff Learman <[email-masked]>

>>	The way to avoid
>>	hacked routers is to use authentication.
	
>>	A router that's about to generate its own LSP but finds it would need to
>>	wrap the sequence number is the only one required to basically shut down
>>	and wait.  And as I said earlier, this is unlikely to happen as I can't
>>	imagine a system remaining up for a thousand years or more. 

It certainly won't ever happen if routers follow the rules, but a sick
router could mess up its own sequence number, and that's something that
authentication won't help. But also, as you pointed out, it's not
the end of the world...just that router that at one point sent bizarro
sequence numbers has to sit in the corner for awhile and wait for its
old LSP to get purged.

I always was a bit nervous about that scenario by the way. Has it been
tested operationally?

Radia

_______________________________________________
Isis-wg mailing list  -  [email-masked]
http://external.juniper.net/mailman/listinfo/isis-wg

---

From: "Ken Larmer" <[email-masked]>
Date: Mon, 21 Jan 2002 09:44:13 -0500

> I always was a bit nervous about that scenario by the way. Has it been

Yes, this was tested on at least one implementation, though it was quite
some time ago now.

BTW,  I believe Harish has a valid security concern here, which
authentication will help to prevent!

>Few queries
>1) A bad/hacked router can intentionally exploit this scenario by changing
>some LSPs sequence number to 0xffffffff and flooding it to the network.
>If the original router(source of the hacked LSP) receives this LSP , then
>what should it do?
>2) Shouldnt the router send a zero age LSP to purge the LSP (seq=fffffff)
> instead of waiting (MaxAge + zeroagelifetime) , so that scenarios like 1
> can be handled ?

A hacker could pose as an adjacent IS and then flood LSPs with a sequence #
= 0xffffff for every IS in the network. This would cause an instant
melt-down of the network, because all IS routers would enter a wait-state in
accordance with ISO-10589, section 7.3.15.1.a.9.d (the section pertaining to
receipt of own LSP), which in turn references section 7.3.16.1 (Sequence
Numbers).

Cheers,
Ken Larmer
CommSense Networks